3 ms·

I think the point is that contemporary malware detection closely monitors straightforward APIs like CreateRemoteThread, but this technique flies below the radar

by 13of40 10y ago

I think the point is that contemporary malware detection closely monitors straightforward APIs like CreateRemoteThread, but this technique flies below the radar for now. It's just another iteration of the arms race.

Const-me 10y ago
That was true 15 years ago, when people run Windows XP using an Administrator account. Those years, without a third-party security product monitoring various API calls, you were pretty much screwed. In modern Windows however, UAC has largely managed the attack vector. Here’s more details on this particular issue: https://blogs.msdn.microsoft.com/oldnewthing/20150519-00/?p=45571 https://blogs.msdn.microsoft.com/oldnewthing/20150519-00/?p=...